Dmitry Sokolov recommends UnHackMe!

UnHackMe is a powerful tool against malware.

UnHackMe quickly removes rootkits/malware/adware/browser hijack issues!

Alex NightWatcher: Solved! (5 / 5)

APPL/Graftor.UA also known as Generic.95F, virus.win32.sality.at.

Malware Analysis of APPL/Graftor.UA – LSL.EXE

Created files:

%Program Files%\luoshenli\Data\UserNoteText.xml
%PROGRAM FILES%\LUOSHENLI\DATA\4579332FA3D69AF4D40FE4DA62F27D64INDEX.HTML
%Program Files%\luoshenli\lsl.exe
%Program Files%\luoshenli\online_c.html
%Program Files%\luoshenli\Power.exe

Autostart registry keys:

HKLM\Software\Classes\Applications\QQLiveUninstaller.exe\NoStartPage: “”
HKLM\SOFTWARE\CLASSES\CLSID\{1DABF8D5-8430-4985-9B7F-A30E53D709B3}\INPROCSERVER32\: “%SYSDIR%\MMINSTALLER.DLL”
HKLM\Software\Classes\CLSID\{4A8FD414-1EBF-4EBD-A158-0D09B005A17F}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveAPI.dll”
HKLM\Software\Classes\CLSID\{5EF7B131-C278-4034-BC88-2CE28B128681}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveOcx.dll”
HKLM\Software\Classes\CLSID\{828D7162-6DA3-4D67-97D0-E87CEC4C8D0D}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveAPI.dll”
HKLM\Software\Classes\CLSID\{D9EBCF5D-3F8F-4B6A-89BA-70577BE73C62}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveAPI.dll”
HKLM\Software\Classes\CLSID\{F7E55BDF-9528-46BA-B550-777859627591}\InprocServer32\: “%Program Files%\Tencent\QQLive\9.16.1664.0\LiveOcx.dll”
HKLM\Software\Classes\qqlive\shell\open\command\: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” “%1″”
HKLM\Software\Classes\QQLive.qlv\Shell\open\Command\: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” “qqlive://playlocal/file=%1″”
HKLM\Software\Classes\qqtv\shell\open\command\: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” “%1″”
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\rlbRunByWindowsStart: “”%Program Files%\luoshenli\lsl.exe” RunDateByStartAuto”
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\qqlive\UninstallString: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLiveUninstaller.exe””
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\qqlive\DisplayName: “????”
HKLM\System\CurrentControlSet\services\QQLiveService\ImagePath: “%SystemRoot%\system32\svchost -k QQLiveService”
HKLM\System\CurrentControlSet\services\QQLiveService\DisplayName: “QQLiveService”
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\qqlive: “”%Program Files%\Tencent\QQLive\9.16.1664.0\QQLive.exe” -system_startup”

Detected by UnHackMe:

LSL.EXE
Default location: %PROGRAM FILES%\LUOSHENLI\LSL.EXE

Dropper hash(md5): 4579332fa3d69af4d40fe4da62f27d64

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.